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1. A methocft of detecting computer viruses within a computer file, said method 
comprising the steps of: 

receiving a request to scan a computer file for computer viruses; 
initiating a virus scanning operation upon said computer file; 

calculating during said virus scanning operation a measurement value indicative of an 
amount of data processing performed during said virus scanning operation; 

comparing during said virus scanning said measurement value with a threshold value; 

and 

triggering a bieak in said virus operation is said measurement value exceeds said 
threshold value. 



2. A method as claimed in claim 1, further comprising the step of, upon occurrence of 
said break, determining using said measurement value whether or not said virus scanning 
operation should be terminated prior to completion. 

3. A method as claimed in claim 1, wherein said measurement value yields a processed 



ocessed during said virus scanning operation. 



data size value for data p :■ 



4. A method as claimed in claim 1, wherein said amount of data processing performed 
includes data processing (involved in any decompression of said computer file required for 
said virus scanning operation. 



5. A method as claimed in claim 1, wherein said amount of data processing performed 
includes data processing involved in any unpacking of said computer file required for said 
virus scanning operation. 



6. A method as claimeld in claim 2, wherein said measurement value yields a processed 
data size value for data processed during said virus scanning operation and step of 
determining is responsive toiboth said processed data size value and a computer file size value 
for said computer file when determining whether or not said virus scanning operation should 
be terminated prior to completion. 
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7. A method as claimed in claim 6, wherein said step of determining calculates a 
measurement ratio of said processed data size value to said computer file size value and 
compares this with a termination size threshold ratio such that said virus scanning is 
terminated if said measurement ratio exceeds said termination size threshold ratio. 
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8. A method as claimed in claim 1, wherein said virus scanning operation applies a 
plurality of tests to said computer file, each test having an complexity value indicative of an 
amount of data processing associated with that test and said measurement value is a sum of 
complexity values for tests applied during said virus scanning operation. 

9. A method as claimed in claim 8, wherein said plurality of test applied are selected in 
dependence upon said computer file. 

10. A method as claimed in claim 2, wherein said virus scanning operation applies a 
plurality of tests to said com] >uter file, each test having an complexity value indicative of an 
amount of data processing associated with that test, said measurement value being a sum of 
complexity values for tests applied during said virus scanning operation and said step of 
determining terminating said virus scanning operation prior to completion if said sum of 
complexity values exceeds a termination complexity threshold value. 

11. Apparatus for detecting computer viruses within a computer file, said apparatus 
comprising: 

a receiver operable to r 

initiating logic operab 

calculating logic opetabl 
measurement value indicative 
scanning operation; 

comparing logic 
value with a threshold value; 

triggering logic operafc 
value exceeds said threshold \ 



ceive a request to scan a computer file for computer viruses; 
.15 to initiate a virus scanning operation upon said computer file; 
e to calculate during said virus scanning operation a 
of an amount of data processing performed during said virus 

operable during said virus scanning to compare said measurement 
quid 

e to trigger a break in said virus operation is said measurement 
alue. 
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,12. Apparatus as claimed in claim 11, wherein, upon occurrence of said break, 
determining lo *ic operates using said measurement value to determine whether or not said 
operation should be terminated prior to completion. 



virus scanning 



5 13. Apparatus 
data size value 



as claimed in claim 12, wherein said measurement value yields a processed 
br data processed during said virus scanning operation. 



14. Apparatus as claimed in claim 1 1, wherein said amount of data processing performed 
includes data processing involved in any decompression of said computer file required for 
said virus scanning operation. 
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15. Apparatus! as claimed in claim 11, wherein said amount of data processing performed 
includes data processing involved in any unpacking of said computer file required for said 
virus scanning operation. 

16. Apparatus afe claimed in claim 12, wherein said measurement value yields a processed 
data size value for mata processed during said virus scanning operation and said determining 
logic is responsive tp both said processed data size value and a computer file size value for 
said computer file when determining whether or not said virus scanning operation should be 
terminated prior to completion. 
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17. Apparatus as claimed in claim 16, wherein said determining logic is operable to 
calculate a measurement ratio of said processed data size value to said computer file size 
value and compare thislwith a termination size threshold ratio such that said virus scanning is 
terminated if said measurement ratio exceeds said termination size threshold ratio. 
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18. Apparatuses claimed in claim 11, wherein said virus scanning operation applies a 
plurality of tests to said domputer file, each test having an complexity value indicative of an 
amount of data processing associated with that test and said measurement value is a sum of 
complexity values for tests applied during said virus scanning operation. 



19. Apparatus as claimqd in claim 18, wherein said plurality of test applied are selected in 
dependence upon said computer file. 
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,20. Appai&tus as claimed in claim 12, wherein said virus scanning operation applies a 
plurality of tests to said computer file, each test having an complexity value indicative of an 
amount of dam processing associated with that test, said measurement value being a sum of 
complexity values for tests applied during said virus scanning operation and said step of 
determining terminating said virus scanning operation prior to completion if said sum of 
complexity values exceeds a termination complexity threshold value. 

21. A computer program product carrying a computer program for controlling a computer 
to detect computer viruses within a computer file, said computer program comprising: 

receiver cofde operable to receive a request to scan a computer file for computer 
viruses; 

initiating code operable to initiate a virus scanning operation upon said computer file; 

calculating code operable to calculate during said virus scanning operation a 
measurement value indicative of an amount of data processing performed during said virus 
scanning operation; 

comparing codfe operable during said virus scanning to compare said measurement 
value with a threshold \talue; and 

triggering code operable to trigger a break in said virus operation is said measurement 
value exceeds said threshold value. 

22. A computer program product as claimed in claim 21, wherein, upon occurrence of said 
break, determining code operates using said measurement value to determine whether or not 
said virus scanning operation should be terminated prior to completion. 

23. A computer program! product as claimed in claim 22, wherein said measurement value 
yields a processed data size value for data processed during said virus scanning operation. 



24. A computer program product as claimed in claim 21, wherein said amount of data 
processing performed includes data processing involved in any decompression of said 
computer file required for said [virus scanning operation. 



25. A computer program product as claimed in claim 21, wherein said amount of data 
processing performed includes data processing involved in any unpacking of said computer 
file required for said virus scanning operation. 
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26. A computer program product as claimed in claim 22, wherein said measurement value 
yields a processed data size value for data processed during said virus scanning operation and 
said determining* code is responsive to both said processed data size value and a computer file 

5 size value for said computer file when determining whether or not said virus scanning 
operation should tie terminated prior to completion. 

27. A computer program product as claimed in claim 26, wherein said determining code is 
operable to calculates measurement ratio of said processed data size value to said computer 



10 file size value and cdmpare this with a termination size threshold ratio such that said virus 
scanning is terminateduf said measurement ratio exceeds said termination size threshold ratio. 

28. A computer program product as claimed in claim 21, wherein said virus scanning 
operation applies a plurality of tests to said computer file, each test having an complexity 

15 value indicative of anl amount of data processing associated with that test and said 
measurement value is a sum of complexity values for tests applied during said virus scanning 
operation. \ 

29. A computer prograjm product as claimed in claim 28, wherein said plurality of test 
20 applied are selected in dependence upon said computer file. 

30. A computer prograni product as claimed in claim 22, wherein said virus scanning 
operation applies a plurality \of tests to said computer file, each test having an complexity 
value indicative of an amountlof data processing associated with that test, said measurement 

25 value being a sum of complexity values for tests applied during said virus scanning operation 
and said step of determining terminating said virus scanning operation prior to completion if 
said sum of complexity values exceeds a termination complexity threshold value. 



